191 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Do Siki	00d6cf9786	sync: update TODO.md with MITHOME-82 (security scan)	2026-08-22 13:40:26 +02:00
Do Siki	28778aef88	feat(security): lightweight cryptominer/backdoor detection script ... Periodic host+container sweep for the exact indicators seen in the staging miner incident: decoy process names (redis-server/kworkerd/xmrig/ssl_client/ init.sh), /tmp/.kworkerd and .redis-server.pid artifacts, and high-CPU containers. Findings are logged and exit 1 for cron MAILTO alerting. Closes MITHOME-82	2026-08-22 13:39:46 +02:00
DO Siki	46db2622d3	content: frissítve a CMS-ből	2026-08-22 13:39:29 +02:00
DO Siki	e715a3aa8b	content: frissítve a CMS-ből	2026-08-22 13:38:43 +02:00
Do Siki	c73cdd3b2f	sync: update TODO.md with MITHOME-78/79/80/81 (review fixes)	2026-08-22 12:39:20 +02:00
Do Siki	d908f6b1b4	chore(quality): type-check and lint gates in pre-deploy, clean lint/tsc ... - pre-deploy suite now runs tsc --noEmit and eslint; any failure aborts the release - fix all TypeScript errors (FooterConfig.copyright removed after the CMS move; test guards/casts) - fix all ESLint errors: <a>→<Link> and <img>→<Image> in Header/Footer, remove unused imports and explicit any in src - eslint config relaxes no-explicit-any/no-require-imports/no-unused-vars for test and CommonJS config files (legitimate usage) Closes MITHOME-81	2026-08-22 12:37:22 +02:00
Do Siki	162e5782e9	refactor(cms): split oversized modules below the 400-line limit ... - content-editor.js: extract the /save handler to scripts/cms-save.js - cms-logo-page.js: inline the ~280-line canvas editor script to scripts/cms-logo-client.js (page is now the HTML/CSS shell only) - cms-editor-client.js: move the keyboard-shortcut section to scripts/cms-editor-shortcuts.js, inlined after the main client All modules now under the hard limit; full pre-deploy suite green. Closes MITHOME-80	2026-08-22 12:31:28 +02:00
Do Siki	15529c7705	fix: contact length limits + logger/next.config nitpicks + dep updates ... - /api/contact enforces per-field length caps (name/email/subject/message) before sanitization/persistence; over-long message returns 400 without touching Mongo (test added) - logger: crypto-based request id (randomUUID) instead of Math.random().substr; defaultMeta.version prefers DEPLOY_VERSION over npm_package_version - next.config: move Turbopack svg rule from deprecated experimental.turbo to top-level turbopack - deps: bump next 15.5.2 → 15.5.23; npm audit fix (19 → 3, remaining are transitive sharp/libvips DoS advisories, not exploitable for static images) Closes MITHOME-78, MITHOME-79	2026-08-22 12:22:27 +02:00
Do Siki	b8f9e8cfdf	sync: update TODO.md with MITHOME-77 (web hygiene)	2026-08-22 12:14:42 +02:00
Do Siki	9f1fb349c2	fix(web): hygiene — OG image/metadataBase, Header a11y text + nav flag, dead code ... - siteConfig.ogImage pointed to an existing asset; metadataBase added so relative OG/Twitter URLs resolve against the real origin instead of localhost - Header sr-only menu label moved to common.json (a11y.openMenu/closeMenu); navigation primary styling driven by a NavigationItem.primary flag instead of brittle 'Kapcsolat' string comparisons - remove dead code: lib/site-config.ts (unused hybrid config) and the unused, schema-divergent siteConfig.contact.form - ContactConfig type cleaned up (address/form removed) Closes MITHOME-77	2026-08-22 12:12:48 +02:00
Do Siki	4c2913e131	feat(cms): add interactive canvas logo editor modal ... Closes MITHOME-76: - Interactive Canvas-based modal for logo editing in CMS - Crop with presets (1:1, 3:1, 4:1, 16:9, free) - Drag-to-pan positioning and wheel/slider zoom - 90 deg rotation and horizontal/vertical flip - Configurable padding/margins around logo - Brightness, contrast, and color invert filters - Direct high-DPI (2x retina) PNG export and atomic save	2026-08-20 11:53:23 +02:00
Do Siki	c5d5198fbf	fix(cms): implement v2 security and stability review findings ... Resolves: - CSRF false positive checked (global POST protection) - Publish mutex to prevent git lock / double deploy - Basic Auth rate limit checked before credential evaluation - Memory leak in rate limiter (added GC interval) - XSS in Toast messages - XSS in data-path attribute - CI healthcheck port mismatch (3000 -> 8080) - Added security headers (X-Frame-Options, X-Content-Type-Options)	2026-08-20 11:35:01 +02:00
Do Siki	768297031d	sync: update TODO.md with MITHOME-75 (keyboard shortcuts)	2026-08-19 22:53:54 +02:00
Do Siki	6030c48abb	feat(cms): keyboard shortcuts — Ctrl+S save, Ctrl+P publish, ? help ... - Ctrl/Cmd+S saves (native browser save dialog suppressed) - Ctrl/Cmd+P publishes; Ctrl/Cmd+Shift+V opens the Versions panel - '?' toggles a shortcuts overlay (Esc/click closes) - plain typing in inputs never triggers actions (modifiers required; '?' only outside editing targets) - jsdom regression tests run the real client script with dispatched KeyboardEvents; the client is evaluated once per suite because each eval would stack another keydown listener on the shared document Closes MITHOME-75	2026-08-19 22:52:09 +02:00
DO Siki	8f72b91fb1	content: frissítve a CMS-ből	2026-08-19 22:33:59 +02:00
Do Siki	db0e898ac4	sync: update TODO.md with MITHOME-74 (publish deploy cwd fix)	2026-08-19 17:41:52 +02:00
DO Siki	2846edfa6e	content: frissítve a CMS-ből	2026-08-19 17:39:30 +02:00
Do Siki	02d6755874	test(footer): assert address from common.json instead of hardcoded city ... The footer address is CMS-editable now; the test must follow the single source instead of a fixed city.	2026-08-19 17:37:36 +02:00
Do Siki	42533ec0aa	fix(cms): deploy exec was missing cwd — landed on / and never ran ... Root cause of publishes not rebuilding the site: the deploy exec child started in the process working directory (repo root), so 'cd ../../../' resolved to the filesystem root, where creating deploy.log failed with Permission denied. The git publish command already used cwd: CONTENT_DIR; the deploy child now does too (caught via live cwd/touch diagnostics in the service context). Closes MITHOME-74	2026-08-19 17:14:02 +02:00
DO Siki	d0270547cc	content: frissítve a CMS-ből	2026-08-19 17:12:37 +02:00
DO Siki	7b3bd2b78b	content: frissítve a CMS-ből	2026-08-19 17:12:35 +02:00
DO Siki	cb1084c0c7	content: frissítve a CMS-ből	2026-08-19 17:11:51 +02:00
DO Siki	3ba453d0a1	content: frissítve a CMS-ből	2026-08-19 17:11:49 +02:00
DO Siki	2ae5247cc6	content: frissítve a CMS-ből	2026-08-19 17:10:27 +02:00
DO Siki	7f4efbde98	content: frissítve a CMS-ből	2026-08-19 17:10:25 +02:00
DO Siki	ce14b6716b	content: frissítve a CMS-ből	2026-08-19 17:08:12 +02:00
DO Siki	6019b8b459	content: frissítve a CMS-ből	2026-08-19 17:08:10 +02:00
DO Siki	5ab3abba2a	content: frissítve a CMS-ből	2026-08-19 17:01:11 +02:00
Do Siki	1fb787413f	sync: update TODO.md with MITHOME-73 (CMS-editable address)	2026-08-19 16:56:19 +02:00
Do Siki	9365c0f1ee	feat(footer): CMS-editable company address (common.json footer.address) ... 'Budapest, Magyarország' lived hardcoded in site.ts. It now lives in common.json (footer.address), editable via the Közös szövegek tab, and both consumers (Footer, Kapcsolat page) read it from there — single source. Schema and types extended; site.ts keeps only the email. Closes MITHOME-73	2026-08-19 16:53:16 +02:00
Do Siki	9c7dc1d35e	sync: update TODO.md with MITHOME-72 (publish deploy reliability)	2026-08-19 15:34:55 +02:00
DO Siki	bbe0ff4c0a	content: frissítve a CMS-ből	2026-08-19 15:31:13 +02:00
DO Siki	d5e2023a1e	content: frissítve a CMS-ből	2026-08-19 15:31:12 +02:00
DO Siki	4a51585bb0	content: frissítve a CMS-ből	2026-08-19 15:29:24 +02:00
DO Siki	fd5e048c11	content: frissítve a CMS-ből	2026-08-19 15:29:22 +02:00
Do Siki	068e148da1	fix(cms): run publish deploy as direct child — detached spawn died under systemd ... Root-caused with systemd-run repros: under the unit's hardening flags the backgrounded grandchild ('cmd &' / setsid) died silently, so a CMS publish committed+pushed but never rebuilt the site (stale content, no deploy.log, no trace). A direct (non-detached) exec child provably survives the same flags; the response is sent first, output goes to deploy.log, and the callback's audit entry now reports real deploy completion (ok/error). Closes MITHOME-72	2026-08-19 15:27:51 +02:00
DO Siki	09228b6a6d	content: frissítve a CMS-ből	2026-08-19 15:17:00 +02:00
Do Siki	a29a1f461b	fix(cms): detach and audit the publish-triggered deploy (systemd-safe) ... A CMS publish's background deploy silently never ran under systemd (naive 'cmd &' child died with the spawning shell; no log, no trace — the site kept serving stale content). The spawn now uses setsid+nohup+stdin-null so it survives any parent exit, and writes deploy_spawned / deploy_exec_exit audit entries so a failed spawn can never be silent again. Closes MITHOME-72	2026-08-19 15:16:19 +02:00
DO Siki	219f5122bd	content: frissítve a CMS-ből	2026-08-19 15:03:37 +02:00
Do Siki	b0cd270dc5	sync: update TODO.md with MITHOME-71 (fresh version tag)	2026-08-19 14:41:19 +02:00
Do Siki	14a72a3ffe	fix(cms): keep version tag fresh — deploy restarts CMS, editor page no-store ... The version tag is the git SHA read at CMS startup, but the deploy script only rebuilt the website container, leaving the tag stale (v8838304 shown after aa8d926 was live). The local deploy script now restarts the CMS service after the server-side deploy (the CMS publish flow is unaffected — it calls deploy.sh directly and never restarts itself). The editor main page also gains Cache-Control: no-store so browsers stop caching it. Closes MITHOME-71	2026-08-19 14:38:40 +02:00
Do Siki	aa8d92646c	test(cms): run-unique markers so a crashed run cannot poison the next ... The versions integration test asserted against fixed marker strings; if a run crashed before restoring contact.json, the next run read the polluted file as its baseline and its expectations collapsed. Markers now carry a per-run timestamp.	2026-08-19 14:30:58 +02:00
Do Siki	c0579198f8	sync: update TODO.md with MITHOME-70 (pre-deploy test suite)	2026-08-19 14:16:04 +02:00
Do Siki	5db71998eb	feat(test): comprehensive pre-deploy test suite as single entry point ... scripts/pre-deploy-tests.sh runs every local test group before a deploy: proto unit (jest), content schema validation, all CMS integration suites (security, serializer, save, optimistic lock, versions, logo, login, logout, guide, bottom bar), publish command/integration and plane sync unit tests. Per-group PASS/FAIL summary; non-zero exit on any failure. deploy_to_stage_on_local.sh now runs the full suite as step 1 — a failing group aborts the release before push. Deploy workflow docs updated. Closes MITHOME-70	2026-08-19 14:15:33 +02:00
Do Siki	067b15c50e	sync: update TODO.md with MITHOME-68/69 (409 UX + stable bottom bar)	2026-08-19 14:05:54 +02:00
Do Siki	88383049d5	fix(cms): stable bottom bar and self-save no longer trips the 409 lock ... MITHOME-68: the optimistic-lock fingerprint was frozen at page load, so the user's own second save 409'd. /save now returns the hash of the written content and the client refreshes CONTENT_HASH on success — 409 only fires for genuine external changes (deploy, other tab, restore). Also: successful logins no longer consume the auth failure budget (only failed attempts do). MITHOME-69: bottom bar items no longer shift while saving/publishing — the status message occupies a constant flex slot (visibility instead of display), the publish button locks its width while running and restores its env-specific label, auto margins removed. Layout guard test added. Test markers are now run-unique so a crashed run can never poison the next one's expectations.	2026-08-19 14:04:49 +02:00
Do Siki	41a2259ede	sync: update TODO.md with MITHOME-67 (delete/reindex fix)	2026-08-19 13:31:56 +02:00
Do Siki	5d2141ec88	fix(cms): capture array container before node removal so reindex runs ... The ❌ delete buttons called wrap.closest('.array-items') AFTER remove(); a detached node has no ancestors, so closest() returned null and reindexItems() silently skipped. Remaining items kept their old indices, collect() produced sparse arrays (null holes) and saves failed schema validation, e.g. '$.details.services[1].specs.items[0]: string érték szükséges'. Capture the container before remove() for both str-item and obj-card delete handlers. Regression test runs the real browser script in jsdom and clicks the actual delete buttons (nested string array + object card reindexing). Closes MITHOME-67	2026-08-19 13:30:53 +02:00
Do Siki	19f2fdfece	refactor(cms): extract /versions and /restore route handling to cms-versions.js ... Companion to the cms-logo.js extraction: keeps content-editor.js under the 400-line hard limit. No behavior change — covered by test-content-editor-versions.js.	2026-08-19 12:47:24 +02:00
Do Siki	d2ee13bb91	feat(cms): logo upload with preview, backup and audit ... - 🎨 Logó page in the CMS bottom bar: replace the website header logo and the CMS login icon with a PNG upload (magic-byte validation, 1 MiB cap) - the replaced logo gets a timestamped backup in .content-backups; every upload is audited (logo_updated) - /logo.png?variant=header serves the header variant for the preview - publish stages proto/public too, so logo changes ride the same commit+deploy pipeline as content - route handling extracted to scripts/cms-logo.js to stay under the 400-line limit - integration test: upload+replace+backup, variant preview, 415/413/400, CSRF, auth Closes MITHOME-65	2026-08-19 12:46:55 +02:00